How to override the version numbers from Spring Boot when importing a BOM pom? - maven

Question

How do I override the version numbers being imported by Spring Boot, without manually setting each artifact in the dependency management section?
<properties>
<spring.boot.version>1.5.7.RELEASE</spring.boot.version>
<jackson.version>2.9.1</jackson.version>
</properties>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>${spring.boot.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
However, when I run
mvn dependency:tree "-Dincludes=com.fasterxml.jackson.*" -Dverbose
the output
[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) # dpt-domain-core ---
[INFO] net.initech.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile
[INFO] | +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO] | \- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.8.10:compile
[INFO] +- (com.fasterxml.jackson.core:jackson-annotations:jar:2.8.0:compile - omitted for duplicate)
[INFO] +- (com.fasterxml.jackson.core:jackson-core:jar:2.8.10:compile - omitted for duplicate)
[INFO] \- (com.fasterxml.jackson.core:jackson-databind:jar:2.8.10:compile - omitted for duplicate)
Where 2.8.10 is the value of jackson.version that org.springframework.boot:spring-boot-dependencies:1.5.7.RELEASE:pom defines.
However, if I explicitly add
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jsr310</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>${jackson.version}</version>
</dependency>
to my dependency management section, then it resolves correctly to:
[INFO] ------------------------------------------------------------------------
[INFO] Building dpt-domain-core 1.0.0
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) # dpt-domain-core ---
[INFO] org.autodatacorp.dpt:dpt-domain-core:jar:1.0.0
[INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.1:compile
[INFO] +- com.fasterxml.jackson.core:jackson-core:jar:2.9.1:compile
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.1:compile
[INFO] \- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.1:compile
[INFO] ------------------------------------------------------------------------
Which is perplexing, since that seems like it should be the equivalent of doing an import of com.fasterxml.jackson:jackson-bom:2.9.1:pom should be the equivalent of pasting the contents of that code into manually.
I even tried
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>${spring.boot.version}</version>
<exclusions>
<exclusion>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
</exclusion>
</exclusions>
<type>pom</type>
<scope>import</scope>
</dependency>
but with no effect.
PS - incase it matters, the Maven I am using is:
Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5; 2015-11-10T11:41:47-05:00)
Java version: 9, vendor: Oracle Corporation

Answer 1

You can re-order your BOM imports and this will work. Place Jackson BOM before the Spring Boot BOM. Quick example https://github.com/Flaw101/gsonconverter/blob/feature/jackson_override/pom.xml
If you use the Spring Boot Parent POM you just need to override their property jackson.version to override versions of other frameworks/libraries
This is also documented by Spring Boot,
https://docs.spring.io/platform/docs/current/reference/html/getting-started-overriding-versions.html
A couple of additional links,
https://docs.spring.io/spring-boot/docs/current/reference/html/using-boot-build-systems.html#using-boot-maven-parent-pom
https://docs.spring.io/spring-boot/docs/current/reference/html/using-boot-build-systems.html#using-boot-maven-without-a-parent

Answer 2

Adding jackson-bom.version to your properties section of the pom.xml file should update jackson dependencies. This will override jackson version in the Spring Boot Parent POM.
<properties>
<jackson-bom.version>2.12.1</jackson-bom.version>
</properties>
Using jackson.version is not going to work. Please see https://github.com/spring-projects/spring-boot/issues/17808

Answer 3

In the app
<dependencyManagement>
<dependencies>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson.version}</version>
<scope>import</scope>
<type>pom</type>
</dependency>
</dependencies>
</dependencyManagement>